2026-10-22_921853fcdec1b5ac2cc600bdc7550557_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_921853fcdec1b5ac2cc600bdc7550557_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos
Size 1.1MB
Sample261024-e872esfx8t
SHA256 e88e17877cb085051049de1f92c3064d6ae59f550980d21babf83be196d4b0d1
MD5 921853fcdec1b5ac2cc600bdc7550557
SHA1 4fbdc6688c685e4370f37e08e1d27ea27215c8bc
SHA512 7dd96767a71cfc81871b249c375a89bfb2ebffe7f29b63b7f9bd93c0d77c565dddf8ce56ab8a209003521e830b50dbff576e9bba220dc2eb174dfa6be6d383c4
SSDEEP 24576:ZvPuGtXLUYJv2Zmko3Wn3Eyl6UkNPrjSwDqBvNtgC+inzE:ZzUJZmnWUrbJjSvwC+WA
TLSH
T1CD450111F185D076E0B201704F7CEBB2293DB870172999EB73E86D6E9E742C07A36766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_921853fcdec1b5ac2cc600bdc7550557_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-10-22_921853fcdec1b5ac2cc600bdc7550557_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

.exe 1.1MB

2026-10-22_921853fcdec1b5ac2cc600bdc7550557_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

IMPHASH 7a51b72b2a6e97ac4dd2a61c38773e2a
SHA256 e88e17877cb085051049de1f92c3064d6ae59f550980d21babf83be196d4b0d1
MD5 921853fcdec1b5ac2cc600bdc7550557
SHA1 4fbdc6688c685e4370f37e08e1d27ea27215c8bc
SHA512 7dd96767a71cfc81871b249c375a89bfb2ebffe7f29b63b7f9bd93c0d77c565dddf8ce56ab8a209003521e830b50dbff576e9bba220dc2eb174dfa6be6d383c4
SSDEEP 24576:ZvPuGtXLUYJv2Zmko3Wn3Eyl6UkNPrjSwDqBvNtgC+inzE:ZzUJZmnWUrbJjSvwC+WA
TLSH
T1CD450111F185D076E0B201704F7CEBB2293DB870172999EB73E86D6E9E742C07A36766
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

123682

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA FindNextFileW FindClose GetLastError OpenThread TerminateThread CloseHandle SetLastError InitializeCriticalSectionEx CreateThread DecodePointer FreeLibrary GetProcAddress GetModuleHandleW lstrcmpiW SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW GetCommandLineW CreateMutexW WriteConsoleW CreateFileW FlushFileBuffers SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW ReadConsoleW SetFilePointerEx GetTimeZoneInformation HeapSize GetConsoleMode GetConsoleCP GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetSystemDefaultLangID GetDateFormatW GetACP WriteFile GetStdHandle GetModuleHandleExW ExitProcess HeapReAlloc ReadFile RtlUnwind GetCurrentProcessId WideCharToMultiByte lstrlenW MultiByteToWideChar GetUserDefaultUILanguage OutputDebugStringA GetCurrentThreadId RaiseException GetCurrentProcess DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetTempPathW GetLocalTime InitializeCriticalSection QueryPerformanceCounter GetStartupInfoW WaitForSingleObjectEx ResetEvent SetEvent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache Sleep SystemTimeToFileTime InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead GetProcessHeap HeapFree HeapAlloc OutputDebugStringW IsDebuggerPresent SetEndOfFile GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW InitializeCriticalSectionAndSpinCount EncodePointer GetTimeFormatW GetSystemTime

user32

KillTimer PostQuitMessage ShowWindow MessageBoxW MessageBoxTimeoutW IsWindowVisible DestroyWindow UnregisterClassW CreateDialogParamW SetWindowLongW CharNextW DispatchMessageW TranslateMessage wvsprintfW IsDialogMessageW RegisterDeviceNotificationW PostMessageW SetWindowTextW SendMessageW GetDlgItem EnableWindow SetWindowPos MapWindowPoints GetClientRect GetMessageW PeekMessageW FindWindowW GetParent GetWindowRect GetMonitorInfoW MonitorFromWindow GetWindowLongW GetWindow LoadImageW SetTimer UnregisterDeviceNotification DefWindowProcW GetSystemMetrics

advapi32

RegQueryInfoKeyW LookupPrivilegeValueW AdjustTokenPrivileges RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumKeyExW OpenProcessToken RegDeleteKeyW RegOpenKeyExW RegQueryValueExW RegCloseKey InitiateSystemShutdownW

shell32

SHGetSpecialFolderPathW

ole32

CoUninitialize CoInitialize CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree

oleaut32

VarUI4FromStr

comctl32

InitCommonControlsEx

libwdi

wdi_register_logger wdi_destroy_list wdi_install_driver wdi_get_vendor_name wdi_create_list wdi_is_driver_supported _wdi_create_lockdown@0 wdi_set_log_level wdi_prepare_driver wdi_unregister_logger wdi_read_logger

winmm

timeGetTime

setupapi

SetupUninstallOEMInfW SetupDiRemoveDevice SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupGetInfDriverStoreLocationW SetupGetInfPublishedNameW SetupDiDestroyDeviceInfoList CM_Locate_DevNodeW CM_Reenumerate_DevNode SetupDiGetDeviceInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiBuildDriverInfoList SetupDiEnumDriverInfoW SetupDiOpenDevRegKey SetupDiGetDeviceRegistryPropertyW SetupDiGetDriverInfoDetailW SetupDiDestroyDriverInfoList

iphlpapi

GetAdaptersInfo

ws2_32

closesocket setsockopt socket connect ntohs inet_ntoa gethostbyname inet_addr htons htonl bind getsockname recv WSACleanup WSAStartup send

Name

.text

Size

266KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

560B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

770KB

Virtual Size

772KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_921853fcdec1b5ac2cc600bdc7550557_darkgate_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos

kernel32

user32

advapi32

shell32

ole32

oleaut32

comctl32

libwdi

winmm

setupapi

iphlpapi

ws2_32

generic